1. Field of the Invention
The invention relates to a method and a device for configuring at least one firewall as well as to a system comprising such device.
2. Description of the Related Art
Firewalls will be deployed in the third generation of mobile phone standards (3G) and beyond networks at various places for protection against attacks and for access control to define which host is permitted to use certain services or applications. Possible locations for firewalls are:                At the changeover point between radio access networks and an IP-based packet core,        inside the packet core network to make attacks more difficult (detection of distributed attacks),        at administrative borders between two operators,        at the entry point of an IP Multimedia Subsystem (IMS), and        towards the public Internet.        
The most common type of firewall is a packet filter that permits traffic flow identified by the IP-5tuple: source address and port number, destination address and port number, and the higher-layer protocol (usually TCP or UDP).
Such packet filters are implemented in a Gateway GPRS Support Node (GGSN) of today's 2.5G and 3G networks, they are used for filtering based on Traffic Flow Templates (TFT, see 3GPP TS23.060) or Service-based Local Policy (SBLP, see 3GPP TS29.207).
For policy control in the IP Multimedia Subsystem (IMS), a Policy Decision Function (PDF) entity has been specified; the corresponding Policy Enforcement Function (PEF) is located in the Gateway GPRS Support Node (GGSN) (see 3GPP TS23.228). Lately, this Policy Enforcement Function (PEF) has been changed to a Policy and Charging Control (PCC) architecture which will unify the previously systems for policy and charging control (see 3GPP TS23.203).
In this new architecture the tasks of a Policy Decision Function (PDF) will be carried out by a Policy and Charging Rules Function (PRCF), the Policy Enforcement Function (PEF) will be included in a Policy and Charging Enforcement Function (PCEF), which is still located inside the Gateway GPRS Support Node (GGSN) or an equivalent network entity, for example a System Architecture Evolution (SAE) Mobility Management Entity and User Plane Entity (MME/UPE) or a Wireless LAN Packet Data Gateway (WLAN PDG).
Currently, the 3GPP standardizes a network architecture labeled “System Architecture Evolution” (see 3GPP TR23.882) which can use access networks like WLAN (see 3GPP TS23.234) and the Long-Term Evolution 3GPP Radio Access Network (LTE, see 3GPP TR25.913). For such architecture, a Mobile IP Home Agent (HA) is considered as an Inter Access System Anchor Point (IASA, see, e.g., 3GPP TR23.882 V1.6.1, FIG. 4-2.1).
Mobility support for IPv4 has been standardized by the IETF as RFC3344, mobility support for IPv6 is defined in RFC 3775. With a mobility-solution based on Mobile IP, the User Equipment UE would assume the role of the Mobile Node (MN) and therefore it would have two IP-Addresses, a Home Address (HoA) and a Care-of Address (CoA) which reflects the Mobile Node's (MN) current position in the network and can therefore change when a handover occurs.
Packets from a Correspondent Node (CN) are sent to the Home Address (HoA) and are routed to the Mobile Node's (MN) Home Network. There, a Home Agent (HA) receives the packets and tunnels them to the Mobile Node's (MN) current Care-of Address (CoA). After a Mobile IP (MIP)-handover, the Home Agent (HA) must be informed about the Mobile Node's (MN) new Care-of Address (CoA), Binding Update messages are used for this purpose.
An improvement of Mobile IP is called Route Optimization (RO) (see 3GPP TR.23.882). When it is activated, the Mobile Node (MN) also sends Binding Updates to the Correspondent Node (CN), which can therefore send data directly to the Mobile Node (MN) without having it routed through the Home Agent (HA). Even with Route Optimization, it is still necessary to have a Home Agent (HA) available which knows the Mobile Node's (MN) Care-of Address (CoA) as new Correspondent Nodes (CN) that may want to contact the Mobile Node (MN) are not aware of the current Care-of Address (CoA) yet.
Packets from the Mobile Node (MN) to the Correspondent Node (CN) are usually not sent via the Home Agent (HA), instead they are sent the direct way thereby improving performance. However, routing via the Home Agent (HA) is also possible and referred to as Reverse Tunneling.
There are a number of differences between Mobile IPv4 and Mobile IPv6. Mobile IPv4 uses a Foreign Agent in the foreign network and may tunnel packets on the direct way between the Mobile Node (MN) and the Correspondent Node (CN). Mobile IPv6 does not need a Foreign Agent and can use Header Options instead of tunnels for direct communication between the Mobile Node (MN) and the Correspondent Node (CN).
Problems arise when a mobile IP (MIP)-handover occurs in a System Architecture Evolution (SAE) network:                Since the data path (or a segment of it) changes the data traffic crosses packet filters that have not been configured,        The traffic end points (IP addresses) change. Therefore, even if a segment of the data path remains the same, firewalls on this segment are not configured to appropriately forward traffic.        
Reference is made to FIG. 1 showing a network topology with two Radio Access Networks (RANs), an IP Multimedia Subsystem IMS and a Mobile IP Home Agent.
FIG. 1 comprises a User Equipment UE that is logically connected to an Application Function AF (in particular a Call Session Control Function CSCF) of the IP Multimedia Subsystem IMS for signaling purposes. A Correspondent Node CN in another network is also logically connected to the Application Function AF (in particular the Call Session Control Function CSCF) of the IP Multimedia Subsystem IMS for signaling purposes. The communication between the User Equipment UE and the Application Function AF as well as between the Application Function AF and the Correspondent Node CN, may be performed using the Session Initiation Protocol SIP.
The traffic of the User Equipment UE may be routed through a 3G connection to a Gateway GPRS Support Node GGSN that is further connected via a Firewall FW with an Inter Access System Anchor (IASA) (in particular a Mobile IP Home Agent MIP HA) of an Evolved Packet Core network. Alternatively, the User Equipment UE may be connected via a Wireless LAN WLAN to a Packet Data Gateway PDG that is further connected via a Firewall FW to the Inter Access System (AS) Anchor (in particular the Mobile IP Home Agent MIP HA) of the Evolved Packet Core network.
The Evolved Packet Core network is connected to the IP Multimedia Subsystem IMS via an additional Firewall FW.
The Inter Access System Anchor (IASA) (in particular the Mobile IP Home Agent MIP HA) of the Evolved Packet Core network can be reached from the Correspondent Node CN via a Security Gateway SEG of the network of the Correspondent Node that is connected to another Security Gateway SEG of the Evolved Packet Core network.
At an initial state, the User Equipment UE is attached to the first Radio Access Network RAN. All firewalls are configured to allow the User Equipment UE to send signaling-traffic to the IP Multimedia Subsystem IMS.    1. The User Equipment UE initiates a session, e.g., by sending an SIP INVITE message to the Application Function AF.    2. The Application Function AF forwards the INVITE message to the Correspondent Node CN. The Application Function AF also triggers packet filter rules to be set by the Policy Control and Charging Rules Function PCRF in the Policy Charging Enforcement Function PCEF located at the Gateway GPRS Support Node GGSN (reference A in FIG. 1) to permit the traffic for this session. Currently, it is open how the firewall at “C” in FIG. 1 will be configured to allow this session.    3. The session starts. The Correspondent Node CN sends traffic to the User Equipment's UE Home Address. The packets reach the Inter Access System AS Anchor which acts as a Mobile IP Home Agent MIP HA and tunnels the packets to the User Equipment UE.
During the session the User Equipment UE makes a handover to Radio Access Network RAN 2 using Mobile IP. The User Equipment UE now has a new Care-of Address which is used as the destination address in all traffic from the Home Agent HA to the User Equipment UE and as the source address for all traffic originating at the User Equipment UE. Traffic that flows between the User Equipment UE and the Access System AS will be blocked by the Policy Charging Enforcement Function PCEF at the I-WLAN Packet Data Gateway PDG (see reference B in FIG. 1), because there is no packet filter rule for this flow configured at said reference B.
If traffic from the User Equipment UE to the Correspondent Node CN was not blocked at B, it would still be blocked at C, as the traffic appears with a new source address there (the new Care-of Address CoA after the handover).
FIG. 2 shows the same situation with Route Optimization activated. After the handover, the packets from the Correspondent Node CN to the User Equipment UE would also be blocked already at reference C as they appear with a new destination address. Again there is no packet filter rule configured for this IP 5-tuple.
The knowledge for the required configuration changes is distributed at several locations in the network.                the Application Function AF (i.e. Proxy Call Session Control Function P-CSCF) knows which sessions are active, but it does not know about the changed Care-of Address CoA;        the Home Agent HA knows about the new Care-of Address CoA, but it does not know about the active sessions as it does not process SIP signaling traffic.        
Note that the Security Gateway SEG in the Correspondent Nodes CN network will also have to be configured in FIG. 1 and in FIG. 2.
So far, the Gateway GPRS Support Node GGSN has been the anchor point for mobility in 3GPP networks. As this point has never changed and as the Gateway GPRS Support Node GGSN is the location of the packet filter towards the user, mobility information has not been required to determine the correct packet filter rules.
Dynamic IP packet filter configuration in security gateways at the changeover points between operator networks has not been touched by 3GPP.